Key Takeaways
- Binance revoked Signalplus API keys on Nov. 5 after a potential security issue.
- CZ urged Signalplus users to revoke API credentials connected to other exchanges.
- Binance says the Signalplus issue has no established connection to its Oct. 29 hack.
The precaution comes just one week after the Binance $6.34 billion hack on Oct. 29, when attackers reportedly compromised 17 hot wallets across multiple blockchains. Although the incidents occurred within days of each other, no evidence has established a connection between them.
Binance Revokes Signalplus API Keys as Precaution
Binance pulled the plug on its Signalplus integrations after receiving notice of a possible security problem involving the external trading service.
“Following a potential security issue reported by third-party platform SignalPlus, we have proactively removed all API keys linked to SignalPlus as an immediate precautionary measure,” the exchange announced on X. The company added:
“Binance’s own systems are unaffected. User funds remain safe.”
Signalplus is a Hong Kong-based financial technology company offering artificial intelligence (AI)-enabled trading tools, options analytics, and execution services. Its software connects to cryptocurrency exchanges through application programming interfaces (APIs), allowing customers to execute trades without transferring their assets away from the exchange.
Affected Binance customers were instructed to review their positions and outstanding orders directly through their accounts. The exchange recommended waiting until Signalplus confirms the problem has been resolved before establishing new API connections. The centralized exchange (CEX) also urged users to enable IP whitelisting, which restricts API access to approved internet addresses, and encouraged other integrated platforms to examine their security controls.
CZ Warns Traders to Revoke Signalplus API Keys
Binance founder Changpeng Zhao, commonly known as CZ, issued a broader warning suggesting traders should examine their Signalplus connections beyond Binance.
“If you use SignalPlus for any other exchange platform, it’s time to revoke all your API keys,” Zhao stated on social media. He followed with another caution:
“It is generally recommend that you do not store your API keys with any 3rd party platform. 🙏”
Zhao also referenced Deribit, a cryptocurrency derivatives exchange specializing in options and futures, noting that the platform had reported the concern. Binance co-founder Yi He echoed the company’s announcement, stating, “Binance’s own systems are unaffected.”
Her specific statement advised customers to inspect open orders, delay reconnecting affected credentials and implement IP whitelisting. The Signalplus security issue remains poorly defined publicly. Neither the nature of the suspected vulnerability nor whether attackers accessed customer credentials has been established in the statements provided.
Signalplus Warning Follows Binance’s $6.34 Billion Hack
The latest precaution arrives as Binance continues dealing with the consequences of its Oct. 29 security breach, which resulted in approximately $6.34 billion in stolen cryptocurrency. The earlier attack involved compromised developer systems, malicious software, and unauthorized access to wallet-signing infrastructure. Attackers subsequently transferred assets across several blockchains.
The FBI attributed that theft to North Korea’s TraderTraitor group, also associated with the 2025 Bybit hack. North Korea denied responsibility. Stablecoin issuers and industry partners reportedly froze or intercepted approximately $2.85 billion. Binance pledged to cover customer losses and began reopening withdrawals in phases on Nov. 1. By early Nov. 5, blockchain tracking estimates placed approximately $3.2 billion in cryptocurrency under the attackers’ control, primarily bitcoin (BTC) and ethereum (ETH).
No Public Link Between Signalplus Issue and Last Week’s Binance Hack
The distinction between the two incidents is significant. October’s breach reportedly involved Binance’s internal wallet infrastructure, while the latest security response concerns API credentials associated with an independent trading platform. Binance’s decision to revoke access also raises questions about third-party trading permissions, particularly when external services retain credentials capable of initiating transactions.
For customers wondering whether they should revoke Signalplus API keys, Zhao’s advice extends to connections with other exchanges, while Binance has already invalidated the affected credentials on its platform. Binance says its systems and customer funds are unaffected, but the scope of the Signalplus security issue remains unconfirmed.
